{"id":2173,"date":"2017-09-08T17:04:11","date_gmt":"2017-09-08T15:04:11","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=2173"},"modified":"2017-09-13T23:01:20","modified_gmt":"2017-09-13T21:01:20","slug":"mp3gain-invalid-memory-write-in-copy_mp-mpglibdblinterface-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/09\/08\/mp3gain-invalid-memory-write-in-copy_mp-mpglibdblinterface-c\/","title":{"rendered":"mp3gain: invalid memory write in copy_mp (mpglibDBL\/interface.c)"},"content":{"rendered":"

Description<\/strong>:
\nmp3gain<\/a> is a program to analyze and adjust MP3 files to same volume.<\/p>\n

The fuzz was done via the aacgain command-line tool which uses mp3gain which bundles an old-modified version of mpg123 called mpglibDBL.
\nThe upstream project seems to be dead, so the issue wasn\u2019t communicated to them.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# aacgain -f $FILE\r\nASAN:DEADLYSIGNAL\r\n=================================================================\r\n==15053==ERROR: AddressSanitizer: SEGV on unknown address 0x104db559357d (pc 0x7f06b1457af7 bp 0x7ffed0c702a0 sp 0x7ffed0c6fa30 T0)\r\n    #0 0x7f06b1457af6  (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.4.0\/libasan.so.3+0x5caf6)\r\n    #1 0x8a8ad0 in copy_mp \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/interface.c:188\r\n    #2 0x8ad77e in decodeMP3 \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mpglibDBL\/interface.c:538\r\n    #3 0x43e767 in main \/var\/tmp\/portage\/media-sound\/aacgain-1.9\/work\/aacgain-1.9\/mp3gain\/mp3gain.c:2262\r\n    #4 0x7f06b0770680 in __libc_start_main (\/lib64\/libc.so.6+0x20680)\r\n    #5 0x4426c8 in _start (\/usr\/bin\/aacgain+0x4426c8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.4.0\/libasan.so.3+0x5caf6) \r\n==15053==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.5.2<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-14412<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00352-aacgain-invalidwrite-copy_mp<\/a><\/p>\n
Timeline:<\/strong>
\n2017-08-28: bug discovered
\n2017-09-08: blog post about the issue
\n2017-09-13: CVE Assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThis bug was identified with bare metal servers donated by Packet<\/a>. This work is also supported by the Core Infrastructure Initiative<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
mp3gain: invalid memory write in copy_mp (mpglibDBL\/interface.c)<\/a><\/p><\/blockquote>\n